WP Prayer

WP Prayer has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2024; 4 are fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 5 of the records (71%). Other recurring categories include Cross-Site Scripting.

4 of the records (57%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2024.

5 independent researchers contributed these findings, most of them (3) reported by Bob Matyas.

Strategic Overview

Avg CVSSMedium

4.8/ 10

Patch Coverage57%

Open

Fixed

Get automatic notifications for all WP Prayer vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2024-3407

WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Arbitrary Prayer Deletion

Read the full analysis

Vulnerability Records

7 records


2024-04-24 00:00	WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Arbitrary Prayer Deletion WP Prayer <= 2.0.9	`CVE-2024-3407`	4.3 Medium	Bob Matyas	No
2024-04-24 00:00	WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Email Settings Update WP Prayer <= 2.0.9	`CVE-2024-3406`	4.3 Medium	Bob Matyas	No
2024-04-24 00:00	WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Settings Update WP Prayer <= 2.0.9	`CVE-2024-3405`	4.3 Medium	Bob Matyas	No
2023-02-14 00:00	WP Prayer <= 1.9.6 - Authenticated(Admin+) Stored Cross-Site Scripting WP Prayer <= 1.9.6	`CVE-2023-25705`	5.5 Medium	Rio Darmawan	Yes
2021-06-30 00:00	WP Prayer <= 1.5.4 - Cross-Site Request Forgery WP Prayer < 1.5.5	`N/A`	4.3 Medium	WPScanTeam	Yes
2021-06-08 00:00	WP Prayer <= 1.6.5 - Cross-Site Request Forgery Bypass WP Prayer <= 1.6.5	`CVE-2021-4412`	4.3 Medium	Jerome Bruandet	Yes
2021-05-17 00:00	WP Prayer <= 1.6.1 - Authenticated Stored Cross-Site Scripting WP Prayer < 1.6.2	`CVE-2021-24313`	6.4 Medium	Bastijn Ouwendijk	Yes

Showing 1–7 of 7 reports